302
14.2.1-D
Dynamic Firewall
IP whitelist
In each interface you can enable automatic blocking of suspicious IP addresses. Use
this whitelist to prevent blocking of individual IPs. In addition no portscan detection is
performed for these IPs.
14.2.2
Policies
SX-GATE's firewall is configured per interface. Additionally each interface has to be
classified into one of four classes, depending on the trustworthiness of the attached
networks. This classification determines the firewall's base setup. You may then define
firewall rules to elaborate the firewall configuration.
Inconsiderate changes of settings in this menu can affect the
system security of SX-GATE and of all networks protected by
SX-GATE.
Firewall rules always have to be specified only for the initial packet. Stateful inspection
will associate related packets with the connection, so e.g. reply packets will be accepted
automatically.
Essentially firewall rules have to be defined in the right place. In the following
explanation, the term "incoming interface" refers to the interface through which the
initial packet of a connection is received by SX-GATE. The "outgoing interface" is
the interface through which a connection's initial packet leaves SX-GATE towards its
destination. There are four kinds of connections:
DNAT (in)
DNAT, also known as portforwarding, changes the destination of a connection.
Rules have to be configured in the incoming interface on tab "DNAT > *". DNAT
affects both, incoming and forwarded connections. A rule can make an incoming
connection out of a forwarding connection, vice versa. No additional incoming or
forwarding rule is required to make a DNAT rule work.
Incoming connections (in)
All connections destined for SX-GATE belong to this group. Select the incoming
interface in the tree menu of SX-GATE's web administration and configure rules
Forwarded connections / Routing (fwd)
Connections passing through SX-GATE belong to this group. SX-GATE is neither
the source nor the destination of the connection. The connection is routed by SX-
